Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cred scan for provider block #86

Merged
merged 1 commit into from
Mar 7, 2024
Merged

Conversation

teowa
Copy link
Contributor

@teowa teowa commented Feb 23, 2024

enhance #83

armstrong credscan [-v] [-working-dir <path to Terraform configuration files>] [-swagger-repo <path/dir to the swagger files>]

option -swagger is changed to -swagger-repo to differentiate the -swagger used in armstrong test command which requires specific json file.

cred scan for azurerm and azapi provider block and scanning below secret properties, firing error if secret is plain text or the referenced variable has a default or not explicitly set sensitive=true:

  • auxiliary_tenant_ids
  • client_certificate
  • client_certificate_password
  • client_id
  • client_secret
  • oidc_request_token
  • oidc_token
  • subscription_id
  • tenant_id

the errors are saved in json/markdown format file, the json is like:

{
    "file_name": "/Users/wt/projects/go/armstrong/hcl/testdata/test.tf",
    "name": "azurerm",
    "type": "provider",
    "property_name": "client_id",
    "error_message": "must use variable for secret field",
    "line_number": 9
  }

Copy link
Member

@ms-henglu ms-henglu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR! LGTM

@ms-henglu ms-henglu merged commit 39095ca into Azure:main Mar 7, 2024
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants